CVE-2026-121446
Medium
Description
svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration.
SeverityMedium
CVSS4.3
Exploit probability—
ProductDarylldoyle Svg-sanitizer
PublishedNov 3, 2026
First seenNov 4, 2026
Weakness typeCWE-791CWE-791
How to fix
Update
- darylldoyle svg-sanitizer1.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| darylldoyle svg-sanitizer | 0.5.0 ≤ v < 1.1.0 | 1.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.